4.2.1 Supporting Processes and Active Policies

In this thesis, the term process is equivalent in meaning as a functional unit executing something in a certain area. In the context of workflow management systems, it is called task. This functional unit may or may not be realised in the form of an executable computer program or algorithm. In most cases it is a mixture of both, a computer program combined with human interaction, as, for instance, in the case of complex decision making.

Each process will be looked at as a set of actions belonging to a functional area. These functional areas are extracted by the investigation of the policy approaches described in chapter  and examined additional organisational and practical concerns.

Table  shows a comparison of characteristics of supporting processes and active policies. These will be discussed item by item beginning with the first one.

Table 4.1: Comparison of supporting processes and active policies

$$	supporting processes	$$	active policies
$$	complex tasks performing a certain area	$$	only management activities
$$	often require human interaction	$$	may require human interaction in case of an enforcement problem
$$	description in various formats	$$	single representation format
$$	use multiple sources of information	$$	use well known notification channels
$$	process various kinds of information	$$	triggered by notifications
$$	move policies	$$	cause the invocation of actions
$$	multiple (ambiguous) roles responsible	$$	single subject responsible for enforcement
$$	consider organisational aspects	$$	organisational aspects already considered
$$	complex execution structure	$$	strictly specified enforcement
$$	review of process and produced data	$$	postcondition to check its enforcement
$$	unknown side effects	$$	explicit consideration of side effects

• There are several processes which are necessary in a policy-based management system. Often they tend to be rather complex such as the refinement process. In contrast, active policies, being the result of such a refinement process, contain only a comparatively small number of activities necessary for the enforcement of a small management subgoal.
• As a result of this, the supporting processes more often require human interaction, whereby the active policies may only need human intervention in case of an enforcement problem. Some enforcement problems can be considered in advance. So, in these cases no intervention is necessary. The ratio of human processing and self-sufficient program processing varies between the different supporting processes. For example, the enforcement of a policy can be done more automatically than the refinement process.
• Processes are described in various formats. The spectrum of format ranges from plain text - as a description for the person with a specific responsibility - to implemented algorithms where full automation is possible. In contrast, once fully refined, active policies will be specified in a policy description format.

• Another consequence of the complexity of the supporting processes is that they use multiple sources and various kinds of information. For instance, the distribution process makes use of information such as the domain structure, the policies to distribute, constraints on the policy distribution, etc. Active policies use only the notifications by which the policies get activated. These are received through well known channels.
• Another difference is that the supporting processes in their entirety make the application of policies happen. They and the policy supporting processes are necessary to create, modify, distribute, etc. policies. The active policies invoke actions for the purpose of management. Only the actions triggered by an active policy may use additional information and information sources as the actions can be part of a large process, for instance an agent.
• In the case of the supporting processes, a number of roles can be involved for accomplishing a task. For instance, the different roles are responsible for refining policies in different areas such as security, performance, etc. An active policy has strictly a single subject responsible for its enforcement. This is explicitly specified in the policy representation.
• The supporting processes must take organisational aspects into account, especially the delegation and refinement process. The delegation process as described in section  almost exclusively has to deal with organisational aspects. In the refinement process organisational principles and constraints (such as costs) are incorporated in the created policies. Another example is the test process which has to prove aspects for which the organisation needs logging data, e.g., required by an insurance company. In case of active policies, the organisational aspects are already considered since they are the result of the refinement process.
• Processes have a complex execution structure. For instance the refinement process can be interrupted when a test or enforcement problem occurs. In comparison to this, the active policies have a strictly specified enforcement task which must be carried out by the enforcement process. The execution structure of policies can become complex by using chaining, i.e., the triggered enforcement of a number of policies. Inter-policy communication is not considered in this thesis, because very little is known about the benefits that can be derived from the complexity.
• The success of the enforcement of the active policy is checked by postconditions which are part of the policy description. Usually, no direct equivalent exists on the side of supporting processes. The closest to that is the reviewing of a process and its produced data. Policy descriptions which can be syntactically checked are produced as a result of the refinement process.
• Active policies cause changes on their targets for the purpose of management and therefore, the consideration of side effects of these changes is crucial for the successful enforcement of a policy. In case of processes, the side effects are usually not investigated in detail. The test process may be an exception, because it can interfere with the enforcement of policies.

For all this reasons, active policies and processes are not considered as equivalent concepts. This will be used in subsection .